https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:36:34 +0000 https://cve.radiocsirt.org/vuln/bit-prometheus-2021-29622 <p><strong>Affected:</strong> Bitnami: prometheus</p> <p>Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL&#39;s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.</p> <p><strong>Affected:</strong> Bitnami: prometheus</p> <p>Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL&#39;s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.</p> https://cve.radiocsirt.org/vuln/bit-prometheus-2021-29622 https://cve.radiocsirt.org/vuln/cleanstart-2026-jd89615 <p><strong>Affected:</strong> CleanStart: prometheus, CleanStart: prometheus-fips</p> <p>CVE-2021-29622 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: prometheus, CleanStart: prometheus-fips</p> <p>CVE-2021-29622 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-jd89615 https://cve.radiocsirt.org/vuln/euvd-2026-26523 EUVD-2026-26523 https://cve.radiocsirt.org/vuln/euvd-2026-26523 https://cve.radiocsirt.org/vuln/fkie_cve-2021-29622 <p>Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL&#39;s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.</p> <p>Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL&#39;s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-29622 https://cve.radiocsirt.org/vuln/gsd-2021-29622 gsd-2021-29622 https://cve.radiocsirt.org/vuln/gsd-2021-29622 https://cve.radiocsirt.org/vuln/msrc_cve-2021-29622 msrc_CVE-2021-29622 https://cve.radiocsirt.org/vuln/msrc_cve-2021-29622 https://cve.radiocsirt.org/vuln/opensuse-su-2021:1162-1 <p>Security update for SUSE Manager Client Tools</p> <p>Security update for SUSE Manager Client Tools</p> https://cve.radiocsirt.org/vuln/opensuse-su-2021:1162-1 https://cve.radiocsirt.org/vuln/rhsa-2021:2438 <p>SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) nodejs-y18n: prototype pollution vulnerability etcd: Large slice causes panic in decodeRecord method etcd: DoS in wal/wal.go etcd: directories created via os.MkdirAll are not checked for permissions etcd: gateway can include itself as an endpoint resulting in resource exhaustion and leads to DoS etcd: no authentication is performed against endpoints provided in the --endpoints flag jwt-go: access restriction bypass vulnerability nodejs-glob-parent: Regular expression denial of service nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag golang: crypto/elliptic: incorrect operations on the P-224 curve gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation containernetworking-cni: Arbitrary path injection via type field in CNI configuration fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise containers/storage: DoS via malicious image go.elastic.co/apm: leaks sensitive HTTP headers during panic nodejs-lodash: command injection via template nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() nodejs-postcss: Regular expression denial of service during source map parsing nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js sanitize-html: improper handling of internationali…</p> <p>SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) nodejs-y18n: prototype pollution vulnerability etcd: Large slice causes panic in decodeRecord method etcd: DoS in wal/wal.go etcd: directories created via os.MkdirAll are not checked for permissions etcd: gateway can include itself as an endpoint resulting in resource exhaustion and leads to DoS etcd: no authentication is performed against endpoints provided in the --endpoints flag jwt-go: access restriction bypass vulnerability nodejs-glob-parent: Regular expression denial of service nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag golang: crypto/elliptic: incorrect operations on the P-224 curve gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation containernetworking-cni: Arbitrary path injection via type field in CNI configuration fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise containers/storage: DoS via malicious image go.elastic.co/apm: leaks sensitive HTTP headers during panic nodejs-lodash: command injection via template nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() nodejs-postcss: Regular expression denial of service during source map parsing nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js sanitize-html: improper handling of internationali…</p> https://cve.radiocsirt.org/vuln/rhsa-2021:2438 https://cve.radiocsirt.org/vuln/suse-su-2021:2664-1 <p>Security update for golang-github-prometheus-prometheus</p> <p>Security update for golang-github-prometheus-prometheus</p> https://cve.radiocsirt.org/vuln/suse-su-2021:2664-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-29622 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: prometheus</p> <p>Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL&#39;s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: prometheus</p> <p>Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL&#39;s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-29622